There's another SSL configuration vulnerability going around; thisone is called Logjam ( also ).Part of the suggested fixes for it is to generate your own strong Diffie-Hellman group instead of usingone of the default groups, and of course another fix is yet moreSSL parameter fiddling. There have been quite a lot of SSL/TLS relatedissues lately, and many of them have required SSL parameter fiddlingat least in the short term.

I've had a long-standing flirtation with lighttpd and my

Once upon a time, it was possible to view the Internet as a generallybenevolent place as far as your traffic was concerned. Both passiveeavesdroppers and man in the middle attacks were uncommon and tookgenerally aggressive attackers to achieve (although it could bedone). Eavesdropping attacks were things you mostly worried abouton (public) wifi or unusual environments like conference networks.

I am afraid that those days are long over now. On the modern Internet, ISPs themselves are one of your threats (both your ISP and other

Yesterday I covered why I basically need to move from ext3 toext4 and I said that the mechanisms of thistransition raise a few issues. So let's talk about them, and inthe process I'll wind up with disappointing news for my own case.Actually, let's lead with the disappointing news:

An ext3 filesystem converted to ext4 almost certainly won't supportext4's nanosecond file timestamps; it will only have ext3 one-secondones .

On the

My home machine has a sufficiently old set offilesystems that many of my actively used filesystems are stillext3, not ext4, including both my home directory and where I keepcode. Normally this isn't something that I particularly think orworry about; it's not like ext4 is a particularly radical advancefrom ext3 (certainly not the same sort of jump that was ext2 toext3, where you got fast crash recovery). As a sysadmin I'm generallycautious with filesystem

In my entry on ZFS delete queues , I mentioned thata filesystem's delete queue is captured in snapshots and so the spaceused by pending deletes is held by snapshots. A commentator then asked:

So in case someone uses zfs send/receive for backup he accidentiallystores items in the delete queue?

This is important enough to say explicitly: YES . Absolutely.Since it's part of a snapshot, the delete queue and all of the spaceit holds will be transferred if you use zfs send to move

Like every other always-consistent filesystem, ZFS needs a solutionto the Unix pending delete problem (files that have been deleted on the filesystem but that are stillin use). ZFS's solution is implemented with a type of internal ZFSobject called the 'ZFS delete queue', which holds a reference toany and all ZFS objects that are pending deletion. You can thinkof it as a kind of directory (and technically it's implemented withthe same underlying storage as directories are, namely a ZAP

By now you may have guessed the punchline of my sudden interest in ZFS delete queues : we had a problem with ZFSleaking space for deleted files that wasultimately traced down to an issue with pending deletes that our fileserver wasn'tcleaning up when it should have been.

As a well-debugged filesystem, ZFS should not outright leak pendingdeletions, where there are no remaining references anywhere yet thefiles haven't been cleaned up (well, more or less; snapshots comeinto the picture, as mentioned )

Unix has a number of somewhat annoying filesystem semantics thattend to irritate designers and implementors of filesystems. One ofthe famous ones is that you can delete a file without losing accessto it. On at least some OSes, if your program open() s a file andthen tries to delete it, either the deletion fails with 'file isin use' or you immediately lose access to the file; further attemptsto read or write it will fail with some error. On Unix your programretains access to the

Yesterday I described an approach towriting lexers in Go that pushed the actual lexing into a separategoroutine, so that it could run as straight-line code that simplyconsumed input and produced a stream of tokens (which were sent toa channel). Effectively we're using a goroutine to implement whatwould be a generator in some other languages. But because we'reusing goroutines and channels, there's something important we needto do: we need to make sure the lexer goroutine is run to completion